🇺🇸
TPI-Abuse
2026-06-27 22:27:52
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 2602:fa59:10:72b::1 (Unknown): 1 in the last 30 ...
show more
(mod_security) mod_security (id:210492) triggered by 2602:fa59:10:72b::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 27 18:27:45.388999 2026] [security2:error] [pid 6850:tid 6850] [client 2602:fa59:10:72b::1:60054] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "vanduijnencoaching.nl"] [uri "/.env"] [unique_id "akBOYVoOC7Dqaxg1liWBpwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇸🇬
nayumi
2026-06-27 21:55:15
(1 day ago)
CrowdSec detection: crowdsecurity/http-sensitive-files | Service: http, http, http, http, http
Web App Attack
🇫🇷
MatStef132
2026-06-25 08:03:20
(4 days ago)
MatShield L7: blocked on mathost.eu (secret-path-probe)
DDoS Attack
🇺🇸
deskpass.com
2026-06-25 07:17:20
(4 days ago)
GET /config/broadcasting.php
Web App Attack
🇺🇸
TPI-Abuse
2026-06-25 07:10:51
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 2602:fa59:10:72b::1 (Unknown): 1 in the last 30 ...
show more
(mod_security) mod_security (id:210492) triggered by 2602:fa59:10:72b::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 03:10:45.519056 2026] [security2:error] [pid 2373:tid 2373] [client 2602:fa59:10:72b::1:10284] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thebradleyclinic.com"] [uri "/.env"] [unique_id "ajzUdXNFGdkeSAP94mFsGAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-06-25 06:33:00
(4 days ago)
1.196 requests with url.path *.env
534 requests with url.path *.git/*
Brute-Force
Bad Web Bot
🇳🇱
e.fierstra
2026-06-25 06:21:27
(4 days ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇳🇱
Savvii
2026-06-25 06:15:58
(4 days ago)
20 attempts against mh-misbehave-ban on frost
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-25 06:00:26
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 2602:fa59:10:72b::1 (Unknown): 1 in the last 30 ...
show more
(mod_security) mod_security (id:210492) triggered by 2602:fa59:10:72b::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 02:00:20.438100 2026] [security2:error] [pid 9884:tid 9884] [client 2602:fa59:10:72b::1:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "eddysgroup.com"] [uri "/.env"] [unique_id "ajzD9CIbsrEkv9aMidjmIgAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2026-06-25 05:45:04
(4 days ago)
Detected WordPress attack from 4 different servers
Brute-Force
Web App Attack
🇺🇸
helios.live
2026-06-25 05:37:49
(4 days ago)
2026/06/25 05:37:48 [error] 1821671#1821671: *1924282 access forbidden by rule, client: 2602:fa59:10 ...
show more
2026/06/25 05:37:48 [error] 1821671#1821671: *1924282 access forbidden by rule, client: 2602:fa59:10:72b::1, server: kocerroxy.com, request: "GET /.env.backup HTTP/1.1", host: "app.kocerroxy.com"
2026/06/25 05:37:48 [error] 1821671#1821671: *1924282 access forbidden by rule, client: 2602:fa59:10:72b::1, server: kocerroxy.com, request: "GET /.env.backup HTTP/1.1", host: "app.kocerroxy.com", referrer: "http://app.kocerroxy.com:80/.env.backup"
2026/06/25 05:37:48 [error] 1821671#1821671: *1924282 access forbidden by rule, client: 2602:fa59:10:72b::1, server: kocerroxy.com, request: "GET /.env.save HTTP/1.1", host: "app.kocerroxy.com"
2026/06/25 05:37:48 [error] 1821671#1821671: *1924282 access forbidden by rule, client: 2602:fa59:10:72b::1, server: kocerroxy.com, request: "GET /.env.save HTTP/1.1", host: "app.kocerroxy.com", referrer: "http://app.kocerroxy.com:80/.env.save"
2026/06/25 05:37:48 [error] 1821671#1821671: *1924288 access forbidden by rule, client: 2602:fa59:10:72b::1, server:
...
show less
Web App Attack
🇩🇪
london2038.com
2026-06-25 05:33:19
(4 days ago)
Probing for exploits
2602:fa59:10:72b::1 - - [25/Jun/2026:07:33:15 +0200] "GET /.git/HEAD HTTP/2.0" ...
show more
Probing for exploits
2602:fa59:10:72b::1 - - [25/Jun/2026:07:33:15 +0200] "GET /.git/HEAD HTTP/2.0" 422 0 "-" "Go-http-client/2.0"
2602:fa59:10:72b::1 - - [25/Jun/2026:07:33:15 +0200] "GET /.git/HEAD HTTP/1.1" 422 0 "-" "Go-http-client/1.1"
show less
Hacking
Web App Attack